Last updated: 12th October 2021
At Virtual Headquarters Limited, we are proud that we are fully compliant with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).
This is a notice to inform you of our policy about all information that we record about you. It sets out the conditions under which we may process any information that we collect from you, or that you provide to us. It covers information that could identify you (“personal information”) and information that could not. In the context of the law and this notice, “process” means collect, store, transfer, use or otherwise act on information. We regret that if there are one or more points below with which you are not happy, your only recourse is to leave our website immediately. We undertake to preserve the confidentiality of all information you provide to us and hope that you reciprocate.
Our policy complies with UK law accordingly implemented, including that required by the EU General Data Protection Regulation (GDPR).
The law requires us to tell you about your rights and our obligations to you in regards to the processing and control of your personal data. You can see further information about your rights, and our obligations, at www.ico.org.uk.
Except as set out below, we do not share, or sell, or disclose to a third party, any information collected through our website.
1.0 OUR CORE BELIEFS REGARDING USER PRIVACY AND DATA PROTECTION
User privacy and data protection are human rights
We have a duty of care to the people within our data
Data is a liability, it should only be collected and processed when absolutely necessary
We will never sell, rent or otherwise distribute or make public your personal information, unless required to do so under applicable Anti Money Laundering laws.
2.0 RELEVANT LEGISLATION
Along with our business and internal computer systems, this website is designed to comply with the following national and international legislation with regards to data protection and user privacy:
UK Data Protection Act 1988 (DPA)
EU Data Protection Directive 1995 (DPD)
EU General Data Protection Regulation 2018 (GDPR)
This site’s compliance with the above legislation, all of which are stringent in nature, means that this site is likely compliant with the data protection and user privacy legislation set out by many other countries and territories as well.
3.0 PERSONAL INFORMATION THAT THIS WEBSITE COLLECTS AND WHY WE COLLECT IT
The law requires us to determine under which basis we process different categories of your personal information and to notify you of the basis for each category. If a basis on which we process your personal information is no longer relevant, then we shall immediately stop processing your data.
3.1 Information we process because we have a contractual obligation to you
When you create an account on our website, buy a product or service from us, or otherwise agree to our terms and conditions, a contract is formed between you and us. To carry out our obligations under that contract we must process the information you give us. Some of this information may be personal information. We will use it in order to:
• sell products to you
• provide you with our services
• provide you with suggestions and advice on products, services and how to obtain the most from using our website
• verify your identity under The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
We process this information on the basis there is a contract between us, or that you have requested we use the information before we enter into a legal contract. Additionally, we may aggregate this information in a general way and use it to provide class information, for example to monitor our performance with respect to a service we provide. If we use it for this purpose, you as an individual will not be personally identifiable. We shall continue to process this information until the contract between us ends or is terminated by either party under the terms of the contract.
3.2 Information we process with your consent
Through certain actions when otherwise there is no contractual relationship between us, such as when you browse our website or ask us to provide you more information about our business, including our products and services, you provide your consent to us to process information that may be personal information.
In order to facilitate the delivery of our services to you, we have a number of agreements in place with recognised office space providers. We only share personal data with the office space provider that operates at the chosen location that you have selected as your office address, this is an integral part of us being able to deliver our services to you. To minimise the risk to your privacy, we only share the minimum amount of personal data necessary to both deliver the services to you, and to meet the local regulatory responsibilities at each chosen office space location.
3.4 Information we process because we have a legal obligation
We require personal information to adhere to The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, this includes photo identification and proof of address. It is our legal obligation to collect this and cannot commence our service to you without this information. We will keep this data for as long as you remain a customer, and then for six years following the cancellation of your account to adhere to current legislation. To find out more about our Money Laundering processes, please follow this link. https://vhq.nearly.live//money-laundering-regulations-virtual-offices/
Your personal documents will be stored with Sync.com which features End-to-end encryption which protects your confidential data in the cloud from unauthorized access at all times. Data is replicated across multiple SSAE 16 type 2 certified datacentre locations.
4.0 THIS WEBSITE COLLECTS AND USES PERSONAL DATA FOR THE FOLLOWING REASONS:
4.1 Site visitation tracking
Like most websites, this site uses Google Analytics and other cookies to track user interaction. We use this data to determine the number of people using our site, to better understand how they find and use our web pages and to see their journey through the website.
Although Google Analytics records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you to us. Google Analytics also records your computer’s IP address, which could be used to personally identify you, but Google do not grant us access to this. We consider Google to be a third-party data processor (see section 7.0 below).
4.2 Contact forms and email links
Should you choose to contact us using the contact form on our Contact us page or an email link, none of the data that you supply will be stored by this website or passed to / be processed by any of the third-party data processors defined in section 6.0. Instead the data will be collated into an email and sent to us over the Simple Mail Transfer Protocol (SMTP). Our SMTP servers are protected by TLS (sometimes known as SSL) meaning that the email content is encrypted using SHA-2, 256-bit cryptography before being sent across the internet. The email content is then decrypted by our local computers and devices.
4.3 Sending a message to our support team
When you contact us, whether by telephone, through our website or by e-mail, we collect the data you have given to us in order to reply with the information you need. We record your request and our reply in order to increase the efficiency of our business. We keep personally identifiable information associated with your message, such as your name and email address so as to be able to track our communications with you to provide a quality service.
4.4 Complaining
When we receive a complaint, we record all the information you have given to us. We use that information to resolve your complaint.
5.0 ABOUT THIS WEBSITE’S SERVER
This website is hosted by TeleData UK Ltd within a UK data centre located in Congleton, England.
Teledata UK Ltd are one of the most reputable data centre providers in the UK, operating a Tier 3+, ISO27001:2013 certified data centre, offering the highest levels of technical resilience and physical security available.
Some of the data centre’s more notable security features are as follows:
– 3m rota-spike security fence and perimeter anti-ram barriers
– Blast proof anti-intruder shielded external windows and doors
– Proximity access locks on all external and internal doors
– Interlocked man-trap doors with biometric iris scanners to gain access into data floors
– Server cabinets have locked doors (no open racks)
– Perimeter and internal IP CCTV system monitored 24×7
– 24×7 on-site security guards with static and mobile patrols
– All on-site personnel are security vetted to BS7858 standard
– Only authorised security cleared staff are allowed into the facility.
– All server details are stored on TeleData UK Ltd’s internal management system that is only accessible from their data centre location. This data is stored in an encrypted format and accessed via a front-end which has two-factor authentication in place on a per-user basis.
– All traffic (transferral of files) between this website and your browser is encrypted and delivered over HTTPS.
6.0 OUR THIRD-PARTY DATA PROCESSORS
We use a number of third parties to process personal data on our behalf. These third parties have been carefully chosen. Some of these third parties are based in the USA and are EU-U.S Privacy Shield compliant.
• Google
• WordPress
• Sync.com
• Onepagecrm
• Chargebee
• Xero
Please note, your data will not be automatically shared with all the above third parties and will only be processed where necessary.
7.0 HOW TO REQUEST YOUR PERSONAL INFORMATION
7.1 Access to your personal information
At any time, you may review or update personally identifiable information that we hold about you and to obtain a copy of any information you may send us a request at [email protected]. Requests for data will be processed within 20 working days, in accordance with the GDPR.
7.2 Removal of your information
In certain circumstances you can ask for the data we hold about you to be deleted, however as stipulated in point 3.3 of this policy, we are required to retain data relating to our Anti-Money Laundering responsibilities for 6 years post termination of our contract with you.
7.3 How you can complain
1.1. If you are not happy with our privacy policy or if have any complaint, then you should tell us by email.
1.2. If you are in any way dissatisfied with how we process your personal information, you have a right to lodge a complaint with the Information Commissioner’s Office. This can be done at https://ico.org.uk/concerns/.
8.0 REGISTRATION WITH INFORMATION COMMISSIONER’S OFFICE (ICO)
Virtual Headquarters Limited is officially registered with the Information Commissioner’s Office (ICO) under registration reference: ZA179926.
9.0 CHANGES TO OUR PRIVACY POLICY
This Privacy Policy may change from time to time in line with legislation or industry developments. We will not explicitly inform our clients or website users of these changes. Instead, we recommend that you check this page occasionally for any policy changes. Specific policy changes and updates are mentioned in the changelog below.
